6 matches found
CVE-2026-120441
OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...
CVE-2026-120441
OwnTone Server versions through 29.3 are vulnerable to an SQL injection in the mpd_sticker_find() function located in src/mpd.c. Unauthenticated remote attackers can exploit this by sending a crafted 'sticker find song' command to the MPD listener on TCP port 6600 . By injecting SQL via the URI a...
CVE-2026-120441 OwnTone Server through 29.3 SQL Injection via MPD sticker find Command
OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...
CVE-2026-120441 OwnTone Server through 29.3 SQL Injection via MPD sticker find Command
OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...
EUVD-2026-115201
OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...
CVE-2026-120441: OwnTone OwnTone Server: OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows…
OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...